Privacy Policy

1. Overview and Scope

GRETA Inc. ("we," "us," or "our") operates ELDO (the "Service"), a financial data platform covering listed companies in South Korea, the United States, and Japan. We are committed to protecting your personal information and being transparent about how we collect and use it.

This Privacy Policy applies to all users of the ELDO platform (eldo-analytics.com and related domains) and explains what data we collect, how we use it, how long we keep it, and the rights and choices you have. The service is currently a free membership service and paid sales have not started; the data processed for payments once they are introduced is described in the payment items of sections 2, 4 and 5.

2. Information We Collect and Why

Membership account data: signing up collects your email address, plus a password only if you sign up with one. We store a profile name used to identify you within the service; we do not ask for your legal name. If you use "Continue with Google", we store the account identifier Google provides (issuer and subject ID) and retain no Google access or refresh tokens. Using the service generates a session identifier (a hash, not the original value), access timestamps, account security events such as sign-in and sign-out, and which consent you gave and when. Filing an inquiry stores its category, title, body and our answer. Email address, profile name, inquiry contents and the Google identifier are encrypted at rest with AES-256-GCM, and passwords are stored only as one-way bcrypt hashes. Your IP address and browser/device details (User-Agent) are not kept in your member record.

We use this data to identify you and sign you in, to secure your account (detecting unauthorized access, managing sessions), to answer inquiries, to prove consent history, and to remember your language setting.

ELDO currently does not offer newsletter subscriptions and does not newly collect email addresses through that channel. You may request deletion of any prior subscription record using the contact details below.

Usage Data: If you opt in to optional analytics, Google Analytics 4 (GA4), provided by Google LLC, may process page views, performance metrics and usage events and use _ga browser identifiers. ELDO removes queries and fragments from visited and previous paths in page views it sends directly, and does not put search terms, inquiry bodies or member emails in events it constructs. We do not describe this data as anonymous. Without consent, the GA script and analytics events are not sent.

GA4 enhanced measurement is off, so it does not automatically measure scrolls, outbound clicks, form interactions, video engagement or file downloads. Granular location and device data collection is disabled in GA settings. This does not mean that all location- or device-related processing is absent: approximate region and basic browser and device information may still be processed.

Technical Data: The service runs on Oracle Cloud Infrastructure (OCI). Its hosting and network layers may process standard connection information such as IP addresses and request times for security and incident response. Application request logs exclude search terms, query strings, request bodies, and user-agent strings.

Payment Data (once payments are introduced): when you make a paid payment, the checkout review screen collects the billing country and a postal code (only for countries where Paddle requires it), recorded with the order together with your sign-in account email address (as the billing contact), and the country estimated from your browser's time zone and language settings is recorded with the order. Businesses billed in South Korea may optionally enter their business registration number and business name, which are recorded with the order when entered. Order, payment and refund history, referral-code entry, reward-coupon issuance and use records, and price-increase notice and consent records (your answer, its time and request identifier, the before/after amounts and effective time shown, and the notice mails' delivery status and attempt count) are also generated. The billing country sets the billing currency and tax; the estimated country is kept only as a record for spotting differences from the billing country and never sets the currency or tax. The business registration number and business name are used to exclude VAT on business purchases. We use this data to process orders and payments, refunds and reward coupons, to confirm and evidence price-increase consent, to handle payment disputes and to keep transaction records required by law. Card numbers and other payment-method details are entered directly in Paddle's checkout; ELDO does not receive or store them. No such data is generated today, since paid sales have not started.

We do not collect financial information, payment card details, or any sensitive personal data beyond what is described above.

3. How We Use Your Information

Analytics data helps us understand how the platform is used so we can improve its features, performance, and content quality.

Production API file logs are used for security and operations; their retention and deletion follow the file-log rules in section 4. Separate technical records processed by the hosting provider may follow its settings and policies.

Where analytics is enabled, you can change or withdraw your analytics consent at any time through Analytics Settings in the footer. Where it is not enabled, the analytics script is never loaded, so nothing is collected. Your choice, the consent-policy version, and the update time are stored in your current browser.

4. Retention and Destruction

We keep each category of data for the period below and then destroy it; data is destroyed sooner once its purpose is fulfilled.

• Account data (email, password hash, profile name, Google identifier, language): kept while your membership is active and destroyed when withdrawal (account deletion) is processed.
• Sign-in sessions: expire 7 days after the last activity and no later than 90 days after issue regardless of activity. The session credential rotates every 24 hours and at most 3 sessions are active per account. Expired or revoked session records are deleted 30 days later.
• Account security events (sign-in, sign-out, session revocation, etc.; no IP or device details): kept for 1 year (365 days) from occurrence, then deleted automatically.
• Inquiry records (category, title, body, answer): kept for replies and follow-up. When you delete an inquiry it disappears from your screens and lists immediately, but the record remains stored with a deletion marker for response and audit history. On membership withdrawal, every inquiry is removed from the original inquiry table regardless of that marker and its encrypted snapshot is moved to a separate internal review archive. This review is not an approval step for withdrawal and does not delay completion. The retention basis, period, owner and destruction timing for each inquiry are determined through that review; no unconfirmed period is applied across the board.
• Consent records (item, version, language, time): kept while your membership is active as proof of consent and destroyed on withdrawal except for the minimum evidence the law requires.
• GA4 analytics data: event data and user data are retained for 14 months each. New user activity resets the user identifier retention period. Most standard aggregated reports are not subject to this period, which is also separate from browser cookie lifetimes. This does not mean that all analytics data is deleted 14 months after its initial collection.
• Archived production API file logs: files older than 30 days (720 hours) since their last modification are cleaned up daily at 23:00 (Korea time). When scheduled cleanup runs normally, files may remain until the next daily cleanup, up to an additional 24 hours; actively written files are excluded from deletion. Separate container output logs rotate by size. Account security events, session records and payment audit records follow their separate retention policies.
• Paid transaction records (once payments launch): records of contracts, withdrawal of subscription, payment and supply of goods are kept for 5 years, and records of consumer complaints or dispute handling for 3 years, stored separately from other data under the Korean Act on Consumer Protection in Electronic Commerce and destroyed afterwards. No such records exist today, since paid sales have not started.
• Deletion requests follow the category-specific handling above. A record with a confirmed retention basis is stored separately and destroyed when that basis ends. Electronic files are deleted irrecoverably.

5. Processors, Third Parties and Cross-Border Transfers

We do not provide or sell personal data to third parties without your prior consent. We may disclose data only to the extent necessary when a lawful request is made by an investigative or supervisory authority under applicable law, and we verify the legality and scope of such requests.

To operate the service we entrust processing to, or use the services of, the following providers. Each external service is governed by its provider's privacy policy.

• (주) 민트기술 — Entrusted work: service deployment and quality assurance (QA), and provision of the service infrastructure (hosting) (using Oracle Cloud Infrastructure in the Seoul region; encrypted storage and processing of all member data).
• Google LLC — Entrusted work: account authentication when you use Continue with Google (verification of the Google-issued identifier and email address); Google Analytics 4 if you opt in to optional analytics (directly sent data described in section 2 and browser identifiers).

The ELDO tag disables Google Signals and ads-personalization signals, and ads personalization is disabled in every region in GA settings. The four account data-sharing settings for Google products and services, modeling and business insights, technical support, and business recommendations are all off.

Third-party provision and cross-border transfer (for paid payments, once payments are introduced): payments are processed by Paddle as the Merchant of Record, and Paddle processes personal data for its own purposes as a controller separate from us. We provide the data below only if you consent separately to the third-party provision and to the cross-border transfer on the checkout review screen. (1) Recipient and country: under Paddle's buyer terms, Paddle.com Inc. (United States) when the billing country is the United States, Paddle.com (Canada) Ltd. (Canada) when it is Canada, and Paddle.com Market Limited (United Kingdom) for every other country, including South Korea and Japan. Under Paddle's privacy policy the data may be transferred on to Paddle affiliates (such as Paddle Payments Limited in Ireland) and their processors; the country whose systems actually process the data of a given payment has not been verified. (2) Items: your billing contact email address (your sign-in account email), the billing country, a postal code (only for countries where Paddle requires it), the business registration number and business name (only when a business in South Korea enters them) and the order details (order number, product, amount charged and any discount (reward coupon)). Your name and address are neither collected nor passed on. (3) Purpose (Paddle's own use): processing the payment as the seller, calculating and filing tax, issuing receipts and invoices, refunds, fraud prevention and meeting legal obligations. (4) Timing and method: sent over an encrypted network (HTTPS) when you proceed with the payment on the checkout review screen. (5) Retention: under Paddle's privacy policy, for as long as your relationship with Paddle continues and for the statutory retention and limitation periods. (6) Your right to refuse and its effect: you may refuse; if you do, you cannot make a paid payment, but the rest of the Service is unaffected. Card numbers and other payment-method details are entered directly in Paddle's checkout; we do not receive them. Paddle's contact details and processing are set out in Paddle's privacy policy (paddle.com/legal/privacy).

Because ELDO serves the Korean, US and Japanese markets together, personal data may be processed on infrastructure outside your country to the extent needed to provide the service. Google account verification and optional Google Analytics are processed through Google LLC services. The specific countries and locations where Google services process the data have not been verified. The cross-border transfer of paid payment data is as described in the paragraph above and is based on the separate consent obtained before payment. If a new cross-border transfer not described in this policy becomes necessary, we set out the recipient, country, timing and method, items, purpose, retention and how to refuse and its effect in this policy before the transfer and obtain any consent the law requires. The protections in this policy apply equally regardless of location.

6. Cookies and Optional Analytics

• Authentication cookie: keeps you signed in and is essential to the service. Blocking it in your browser prevents sign-in.
• Preferences: theme, display currency and your analytics choice are stored only in your browser and never saved to the server as member data. Your language setting is additionally stored as member data so notification emails arrive in your language, and it is destroyed on the same basis as the account data in Section 4.
• Optional analytics (GA4): the GA script loads only where analytics is enabled and you opt in through Analytics Settings in the footer; it may set browser identifier cookies such as _ga and _ga_<measurement stream>. The script and events remain off after a refusal and until you choose under the new notice. Withdrawal immediately disables collection and expires the known GA cookies.
• You can delete or block cookies in your browser settings; some features may then be limited.

7. Your Rights and Withdrawal

You have the right to access, correct, delete or suspend processing of the personal data we hold about you and to withdraw consent. For rights requests other than membership withdrawal, contact dev_virgo@the-greta.com from your signup email. After verifying your identity we act within the period the law sets and reply with the result; if we refuse a request we explain why and how to object.

You can withdraw directly from the Settings screen in the account menu. An account with an active password credential confirms with that password; any other account confirms with a verification code sent to its registered email. Withdrawal completes immediately without separate administrator approval. If a payment or refund is still being processed, please request withdrawal again after that processing finishes. If you still cannot withdraw after some time, please let us know at dev_virgo@the-greta.com; we will tell you the outcome within 10 days. Every sign-in session then ends, account personal data is destroyed under Section 4, and inquiry records move to internal review at the same time. Inquiry review neither delays withdrawal nor turns it into an approval process.

Where analytics is enabled, withdrawing your analytics consent takes effect immediately through Analytics Settings in the footer. A legal guardian may exercise the same rights on behalf of a child.

8. Children's Privacy

ELDO handles corporate filings and market data and is not directed at children. The service is intended for users aged 14 or over in South Korea, 13 or over in the United States and 15 or over in Japan; proceeding with signup confirms you meet the requirement. We do not collect a date of birth or age, so age is not verified automatically.

If we learn that personal data of a child below the age set by local law was collected without guardian consent, we destroy it without delay. If you believe your child's data was collected, please contact us below.

9. Security Measures

• Email address, profile name, inquiry contents and the Google identifier are stored encrypted with AES-256-GCM; passwords are kept only as one-way bcrypt hashes.
• Sign-in sessions are stored as hashes, rotated regularly and expire. You can end sessions on other devices from the Settings screen in the account menu.
• All traffic is encrypted with HTTPS, and the application's database account follows least privilege with access only to the tables and columns it needs.
• We minimize collection itself: no IP or device details in member records and no search terms or request bodies in request logs.

10. Privacy Officer and Contact

Privacy Officer — Name: KIM HYUN TAE · Title: CEO · Contact: dev_virgo@the-greta.com · 070-8648-1024

Company contact: 070-8648-1024 · dev_virgo@the-greta.com

Requests to access, correct, delete or suspend processing, consent withdrawal, membership withdrawal and any other questions: dev_virgo@the-greta.com. Requests are handled after identity verification within the period the law sets, and we reply with the result.

For reports or counselling on privacy infringements in Korea you may also contact the Personal Information Infringement Report Center (privacy.kisa.or.kr, 118) or the Personal Information Dispute Mediation Committee (kopico.go.kr, 1833-6972).

11. Changes to This Policy

Applies from service launch (effective date separately announced). This text was supplemented on 2026-09-07; the revision date does not establish the effective date. The consent version recorded at signup is 2026-10-04.1.

ELDO is a Beta-stage platform. This policy may be updated as the service evolves; material changes are announced via the platform or email at least 7 days before they take effect (30 days for changes unfavourable to users).

• Terms of Service
• Refund Policy
• Copyright Notice